CVE-2017-6740
Published: 17 July 2017
Summary
CVE-2017-6740 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Cisco Ios. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 5.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-7 (Boundary Protection).
Deeper analysis
The vulnerability is a set of buffer overflow conditions in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software. The flaws affect all SNMP versions (1, 2c, and 3) and can be triggered by a crafted SNMP packet sent over IPv4 or IPv6; only traffic directed at the device itself can be used for exploitation. All releases are impacted unless the affected MIBs or OIDs have been explicitly excluded.
An authenticated remote attacker who knows the SNMP read-only community string (for versions 2c and earlier) or possesses valid user credentials (for version 3) can send the malicious packet to achieve arbitrary code execution with full control of the device or to force a reload. The attack requires no user interaction and can be launched from anywhere on the network path that reaches the SNMP service.
Cisco Security Advisories recommend applying the workarounds described in the advisory or installing fixed software identified via the Cisco IOS Software Checker; any device with SNMP enabled and without explicit exclusions for the vulnerable objects should be treated as affected. The issues are tracked under CWE-119 with a CVSS 3.1 base score of 8.8.
The vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-15794
Vulnerability details
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An…
more
attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload. Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. There are workarounds that address these vulnerabilities.
- CWE(s)
- KEV Date Added
- 03 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Boundary Protection can be configured to block all inbound SNMP traffic (UDP 161/162) except from explicitly authorized management stations, directly stopping the crafted IPv4/IPv6 packets that trigger the buffer overflow.
Access Enforcement implements the required SNMP community-string or v3 credential checks and can restrict the service to read-only views or specific source addresses, preventing unauthorized attackers from reaching the vulnerable OIDs.
Flaw Remediation requires timely installation of the Cisco IOS/IOS-XE patches that eliminate the SNMP buffer-overflow conditions (CWE-119) described in the advisory.